Static task
static1
Behavioral task
behavioral1
Sample
Install_01210.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Install_01210.exe
Resource
win10v2004-20240412-en
General
-
Target
d59c57d6fea1a873bac03df7eecddb0f2075880a8d4c45c71edd0167e6a48ae5
-
Size
22.7MB
-
MD5
17e16a084f2f021baac9da22c30408a7
-
SHA1
f4e444092b6eee580e78d7d46978ca973adaf8ce
-
SHA256
d59c57d6fea1a873bac03df7eecddb0f2075880a8d4c45c71edd0167e6a48ae5
-
SHA512
6c89abcd11216724da20816357c5b130ecf68f1606a0020eb2df67bedf2ea519ca95da679fb3217a95799103be9c283af1a46817d9c078d22d8f15b915e52824
-
SSDEEP
393216:qHv6mi7LIkUcQCat2NmYAbbJ/+s1F4Jo/XHQQb+lP7Hr9ethi10pt22TeqdjgWNd:ONoIkHQJtkLAbbDFk0HQQb+lP7HrS2Wj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Install_01210.exe
Files
-
d59c57d6fea1a873bac03df7eecddb0f2075880a8d4c45c71edd0167e6a48ae5.zip
-
Install_01210.exe.exe windows:6 windows x86 arch:x86
a6aae0c9deacd5a8c209bf0fcdc8c065
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ReleaseSRWLockExclusive
ReadConsoleW
TlsSetValue
CreateTimerQueue
FreeLibrary
GetModuleHandleW
TlsAlloc
GetModuleHandleExW
MoveFileW
GetFileAttributesA
GetCurrentThreadId
SleepEx
lstrlenA
SetPriorityClass
SetEvent
GetModuleFileNameA
LeaveCriticalSection
GetLogicalProcessorInformation
SetFileAttributesW
InitializeCriticalSection
GetProcAddress
MoveFileA
GetLastError
QueryDepthSList
GetVersion
GetFileAttributesW
GetACP
CreateEventW
VerifyVersionInfoW
LocalFree
IsDebuggerPresent
WaitForSingleObjectEx
LoadLibraryExW
GetUserDefaultLCID
GetSystemDirectoryW
GetProcessAffinityMask
ReleaseSemaphore
FindFirstFileA
lstrcatA
HeapReAlloc
AreFileApisANSI
DeleteFileA
SetFileTime
CreateSemaphoreA
GetProcessHeap
FindNextFileA
SetFilePointer
GetOEMCP
HeapFree
RegisterWaitForSingleObject
GetFileType
VirtualProtect
ExitProcess
CloseHandle
GetFileSizeEx
FindFirstFileW
GetFileAttributesExW
ExitThread
SetUnhandledExceptionFilter
GetCPInfo
ChangeTimerQueueTimer
GetTimeFormatW
GetStartupInfoW
GetCurrentProcessId
GetLogicalDriveStringsA
DuplicateHandle
FlushFileBuffers
IsProcessorFeaturePresent
CompareStringW
GetCurrentDirectoryA
SetFileAttributesA
UnregisterWaitEx
PeekNamedPipe
GetCurrentThread
RaiseException
GetModuleFileNameW
InterlockedPushEntrySList
FindClose
GetCurrentDirectoryW
GetCommandLineA
SetStdHandle
FreeEnvironmentStringsW
AcquireSRWLockExclusive
RemoveDirectoryA
SetThreadPriority
TerminateProcess
GlobalAlloc
DeleteFileW
InitializeSListHead
EnumSystemLocalesW
MoveFileExW
GetDateFormatW
GlobalFree
SetEndOfFile
WideCharToMultiByte
FormatMessageW
GetSystemTimeAsFileTime
SetThreadAffinityMask
ResetEvent
SystemTimeToTzSpecificLocalTime
HeapAlloc
GetConsoleMode
GetEnvironmentStringsW
EncodePointer
TryEnterCriticalSection
WriteFile
FileTimeToLocalFileTime
WaitForMultipleObjects
GetFullPathNameW
GetFileInformationByHandle
SetFilePointerEx
CreateFileA
VirtualAlloc
GetThreadTimes
InterlockedPopEntrySList
FindFirstFileExA
CreateFileW
GetCommandLineW
FreeLibraryAndExitThread
SetEnvironmentVariableA
RtlUnwind
SignalObjectAndWait
GetVersionExA
CreateEventA
GlobalMemoryStatus
RemoveDirectoryW
ReadFile
CreateThread
GetEnvironmentVariableA
UnregisterWait
TlsGetValue
QueryPerformanceCounter
FindNextFileW
UnhandledExceptionFilter
GetLocaleInfoW
CreateTimerQueueTimer
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
GlobalLock
GetFileSize
GetDriveTypeW
SwitchToThread
LoadLibraryW
VirtualFree
GetModuleHandleA
MultiByteToWideChar
GetStdHandle
WaitForSingleObject
GetStringTypeW
LoadLibraryA
SetLastError
TlsFree
CreateDirectoryW
HeapSize
EnterCriticalSection
GetTickCount
DeleteTimerQueueTimer
GetSystemInfo
LCMapStringW
GetThreadPriority
InitializeCriticalSectionAndSpinCount
GlobalUnlock
GetCurrentProcess
Sleep
GetTickCount64
GetVersionExW
QueryPerformanceFrequency
CreateDirectoryA
FileTimeToSystemTime
FormatMessageA
GetConsoleCP
IsValidLocale
WriteConsoleW
InterlockedFlushSList
IsValidCodePage
GetTimeZoneInformation
CompareFileTime
VerSetConditionMask
GetLogicalDriveStringsW
GetNumaHighestNodeNumber
user32
GetParent
EmptyClipboard
GetMonitorInfoA
ShowWindow
IsDlgButtonChecked
GetWindowTextLengthA
SetWindowTextA
DialogBoxParamW
SetWindowLongA
MessageBoxA
SendMessageA
CloseClipboard
wsprintfA
GetWindowTextLengthW
SetWindowTextW
SetCursor
CharUpperA
LoadIconA
ScreenToClient
LoadStringW
SetTimer
LoadCursorA
MessageBoxW
SetFocus
PostMessageA
SendMessageW
GetWindowRect
OpenClipboard
GetWindowLongA
EnableWindow
GetFocus
CharUpperW
GetKeyState
DialogBoxParamA
SystemParametersInfoA
LoadStringA
MoveWindow
KillTimer
GetWindowTextA
MapDialogRect
EndDialog
InvalidateRect
GetDlgItem
SetClipboardData
CheckDlgButton
MonitorFromWindow
GetWindowTextW
advapi32
CryptGetHashParam
CryptDestroyHash
CryptImportKey
CryptAcquireContextW
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptReleaseContext
CryptEncrypt
CloseServiceHandle
shell32
SHGetSpecialFolderPathW
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ole32
CoUninitialize
CoTaskMemFree
CoCreateInstance
CoInitialize
OleInitialize
oleaut32
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
bcrypt
BCryptGenRandom
crypt32
CertFreeCertificateContext
CertFindCertificateInStore
CertFindExtension
CertGetCertificateChain
CertFreeCertificateChainEngine
CryptDecodeObjectEx
CertCreateCertificateChainEngine
CertAddCertificateContextToStore
CryptStringToBinaryW
CertOpenStore
CertCloseStore
CertGetNameStringW
CertFreeCertificateChain
CertEnumCertificatesInStore
PFXImportCertStore
CryptQueryObject
wldap32
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord145
ord219
ord46
ord14
ord216
ord73
ord208
ord41
ord117
ord26
ws2_32
WSACloseEvent
WSAIoctl
recvfrom
sendto
getpeername
ioctlsocket
gethostname
socket
getsockopt
send
getaddrinfo
WSAEnumNetworkEvents
freeaddrinfo
WSAResetEvent
WSAEventSelect
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
htons
setsockopt
WSACreateEvent
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
Sections
.text Size: 6.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 236KB - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ